AGS: Segfault on Urban Witch Story

[Thunderforge]

A segfault happens consistently with ​Urban Witch Story.

Reproduction Steps

1. Start a new game
2. Go through the opening sequence by clicking through all the dialogue (fastest resolution is to choose "Is there anything else inside the house?" followed by "I don't want to waste your time"
3. After being shown the controls for left-click and right-click, click on the police car
4. Jackson will ask if everything is okay and then ScummVM will crash with a segfault

Crash Report

{{
Process: scummvm [98050]
Path: /Applications/ScummVM.app/Contents/MacOS/scummvm
Identifier: org.scummvm.scummvm
Version: 2.3.0git (2.3.0git)
Code Type: X86-64 (Native)
Parent Process: ??? [1]
Responsible: scummvm [98050]
User ID: 502

Date/Time: 2021-07-15 21:38:30.973 -0500
OS Version: macOS 11.4 (20F71)
Report Version: 12
Anonymous UUID: 0AA5D204-3785-7750-75EA-380129269336

Sleep/Wake UUID: D8B221B7-F5AD-46D6-96A2-67A46005F199

Time Awake Since Boot: 360000 seconds
Time Since Wake: 930 seconds

System Integrity Protection: enabled

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00007febae774000
Exception Note: EXC_CORPSE_NOTIFY

Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [98050]

VM Regions Near 0x7febae774000:

MALLOC_LARGE 7febae729000-7febae774000 [ 300K] rw-/rwx SM=PRV

-->

STACK GUARD 7ffeea573000-7ffeedd73000 [ 56.0M] ---/rwx SM=NUL stack guard for thread 0

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 org.scummvm.scummvm 0x0000000101a3d52e AGS3::BITMAP::getColor(unsigned char const*, unsigned char) const + 110
1 org.scummvm.scummvm 0x0000000101a3d07a 0x10168d000 + 3866746
2 org.scummvm.scummvm 0x0000000101a39ac9 0x10168d000 + 3853001
3 org.scummvm.scummvm 0x0000000101a77979 0x10168d000 + 4106617
4 org.scummvm.scummvm 0x0000000101ac3bcf 0x10168d000 + 4418511
5 org.scummvm.scummvm 0x0000000101ac2a4a 0x10168d000 + 4414026
6 org.scummvm.scummvm 0x0000000101ac0d07 0x10168d000 + 4406535
7 org.scummvm.scummvm 0x0000000101ac4e85 0x10168d000 + 4423301
8 org.scummvm.scummvm 0x0000000101bded30 0x10168d000 + 5578032
9 org.scummvm.scummvm 0x0000000101bde9c7 0x10168d000 + 5577159
10 org.scummvm.scummvm 0x0000000101bde487 0x10168d000 + 5575815
11 org.scummvm.scummvm 0x0000000101bde170 0x10168d000 + 5575024
12 org.scummvm.scummvm 0x0000000101bdeec9 0x10168d000 + 5578441
13 org.scummvm.scummvm 0x0000000101bde9c7 0x10168d000 + 5577159
14 org.scummvm.scummvm 0x0000000101ae1da8 0x10168d000 + 4541864
15 org.scummvm.scummvm 0x0000000101bdbcc0 0x10168d000 + 5565632
16 org.scummvm.scummvm 0x0000000101bde153 0x10168d000 + 5574995
17 org.scummvm.scummvm 0x0000000101bddbd8 0x10168d000 + 5573592
18 org.scummvm.scummvm 0x0000000101ae239f 0x10168d000 + 4543391
19 org.scummvm.scummvm 0x0000000101ae34d5 0x10168d000 + 4547797
20 org.scummvm.scummvm 0x0000000101ae3593 0x10168d000 + 4547987
21 org.scummvm.scummvm 0x0000000101bc06c8 0x10168d000 + 5453512
22 org.scummvm.scummvm 0x0000000101bbfe7e 0x10168d000 + 5451390
23 org.scummvm.scummvm 0x0000000101bc0e2f 0x10168d000 + 5455407
24 org.scummvm.scummvm 0x0000000101bc0d83 0x10168d000 + 5455235
25 org.scummvm.scummvm 0x0000000101bc2282 0x10168d000 + 5460610
26 org.scummvm.scummvm 0x0000000101bb99fa 0x10168d000 + 5425658
27 org.scummvm.scummvm 0x0000000101a1c6b5 0x10168d000 + 3733173
28 org.scummvm.scummvm 0x00000001016c15ef 0x10168d000 + 214511
29 org.scummvm.scummvm 0x00000001016bf594 0x10168d000 + 206228
30 org.scummvm.scummvm 0x00000001016bbb10 0x10168d000 + 191248
31 libdyld.dylib 0x00007fff20331f5d start + 1

Thread 0 crashed with X86 Thread State (64-bit):

rax: 0x00007febae774000 rbx: 0x00000000ffffffff rcx: 0x0000000000000003 rdx: 0x0000000000000004
rdi: 0x00007febaa1bce68 rsi: 0x00007febae774000 rbp: 0x00007ffeee56efb0 rsp: 0x00007ffeee56ef90

r8: 0x0000000000000004 r9: 0x00007ffeee56f000 r10: 0x00000000ffffffff r11: 0x0000000000000001

r12: 0xf11ceef51e2f00ad r13: 0x000000000000000c r14: 0x00007febad185000 r15: 0x00000001061a7800
rip: 0x0000000101a3d52e rfl: 0x0000000000210246 cr2: 0x00007febae774000

Logical CPU: 2
Error Code: 0x00000004 (no mapping for user data read)
Trap Number: 14

Thread 0 instruction stream:

75 e8 88 55 e7 0f b6 45-e7 89 c1 83 e9 01 89 45 u..U...E.......E
e0 0f 84 27 00 00 00 e9-00 00 00 00 8b 45 e0 83 ...'.........E..
e8 02 0f 84 25 00 00 00-e9 00 00 00 00 8b 45 e0 ....%.........E.
83 e8 04 0f 84 23 00 00-00 e9 2c 00 00 00 48 8b .....#....,...H.
45 e8 0f b6 08 89 4d fc-e9 2b 00 00 00 48 8b 45 E.....M..+...H.E
e8 0f b7 08 89 4d fc e9-1c 00 00 00 48 8b 45 e8 .....M......H.E.

[8b]08 89 4d fc e9 0e 00-00 00 48 8d 3d 57 50 b0 ...M......H.=WP. <==

03 31 c0 e8 ca 0b 67 03-8b 45 fc 48 83 c4 20 5d .1....g..E.H.. ]
c3 90 55 48 89 e5 41 57-41 56 41 55 41 54 53 48 ..UH..AWAVAUATSH
81 ec 48 01 00 00 8b 45-28 4c 8b 55 20 4c 8b 5d ..H....E(L.U L.]
18 48 8b 5d 10 48 89 7d-d0 40 88 75 cf 88 55 ce .H.].H.}.@.u..U.
88 4d cd 44 88 45 cc 4c-89 4d c0 48 8b 7d d0 4c .M.D.E.L.M.H.}.L

Thread 0 last branch register state not available.
}}